International Journal of Engineering and Technical Research (IJETR) 
ISSN: 2321-0869, Volume-2, Issue-12, December 2014 


A method to identify and prioritize potential risks of 
software projects based on C# codes. 

Syyed Javad Mohammadi Bayg, Mehran Mokhtari 


Abstract — Identify of potential risks is the first step in the 
management risk of software projects. It is a key step that other 
steps are based on it. In this paper a model is presented to 
improve the process of identifying potential risks. This model 
can vouch (assure) development of software projects. A matrix 
solution is given (is presented) to identify the levels of potential 
risks. Solutions and the causes of risks are classified based on the 
known and unknown, and also the levels were determind. The 
design of this model, in addition to strategy (admission, transfer) 
to avoid risks and probabilities are modi lied with new 
informations. A search algorithm (condition-action) is used to 
identify and prioritize potential risks based on sequence data 
structure. This algorithm has been implemented based on the C# 
codes and it also works on boolean variables. To implement the 
algorithm operating functions such as searching, planning, 
control, events, and management were used. To complete it these 
functions provided by the law-condition apply the potential risks 
are identified and then prioritized. Zero, and one decision 
variables to store intermediate results in their practice of 
inference, as intelligently manage event risks. The 
implementation of this model in various stages leading to 
optimized selection of the new solution, and output of model 
reduces the cost, schedule, and quality of software development. 
Also the risks and complexities and uncertainties are controlled. 
The validity of this method is assessed qualitatively using a 
practical example. This example relates to the users of ICT in 
training and education center in mazandaran were evaluated. 

Index Terms — Risk identification, operating functions, 
matrix solutions-causes, Boolean variables, C#, ICT. 

I. Introduction 

The project is a unique process which involves a series of 
coordinated and controlled activities with requires limited of 
time, expenses, and resources [2]. Project management 
applying knowledge, skills, tools, and necessary techniques. 
Implementation of its activities to provide the needs and 
expectation of stakeholders. Risks is a situation that can lead 
to accident. Purpose of identifying risks, is providing a 
position to assess, reduce and eliminate risk at its best 
condition. Risks are the possibility of conversion to an 
incident or accident risk [5] risks are defined as: The 
probability that an incident or accident risk to be converted 
[1 1], Project risks, that threaten the developing software and 
organization [1]. Types of risks that may be effective projects, 
depending on project and organizational environment where 
software is developed. But manage risks are universal [1], 
Managing project risk is any uncertainly, if it occurs, one or 
more project (time, cost, performance, quality, scope. 
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customer satisfaction) are affected [8], Risk management in 
software project development projects as an independent field 
research in 1989, it was recognized when bohm’s 
book ’’software risk management” was published [10]. The 
purpose of software development projects, building high 
quality software that provides customer needs in terms of time 
and budget [9]. However, a variety of risks, complexity and 
uncertainly in software development that it is hard to control. 
If you have not done a proper project management, software 
projects will not reach ang where [9]. Developing of 
management theories, planning, and developing of their 
applications, required the use of tools on risk management. In 
particular strongly felt in centered learning of environment. In 
general, the following objectives have always been about risk 
management: 

1) Identification and definition of project risks and evaluate 
them in general. 

2) Eliminate or reduce risks of project, regardless of which 
party assumes, underlying the risks of project. 

3) Distribution, transmission of risk in a correct order 
among the project members. 

In general, risk management increases the likelihood of 
success, and it will reduce the probability of failure and 
uncertainty in achieving the overall objectives of the 
organization. In this article there are 5 basic factors for risk 
project software management include: Recognize potential 
risks, analyze risks, planning to answer the risks, controlling 
and (risk monitoring), and decision variables. 

Identify risk management of software projects is an 
essential step, as other steps are based upon it [6]. 

The main methods and tools employed in the identification 
of risks are discussed in the following six areas: Search on the 
list of potential risks, search on the list of prioritized risks, risk 
response planning, controlling and monitoring risk, event 
risk, management risk and the termination of the risk. Risk 
identification rules, based on historical data that is relevant to 
the project as strengthening ICT users in education training 
organization in mazandaran provience. Risk identification 
algorithm is based on the Boolean variable values ok, okl, 
ok2, acts on the C# code [Appendix 1], 

In this article the main objective is to identify and prioritize 
potential risks associated with the project strengthening ICT 
users. The selections of an appropriate strategy for those risks 
that have been prioritized. Later phases of the proposed model 
is presented in section 2. In the third section, case study, and 
forth section discussion and conclusion are presented. 

II. Phases of the proposed model. 

First phase: Identification of potential risks phase. 

Identify of potential risks is the first step in the risk 
management of software projects [1], In this phase of the 
project risks are identified an recognized, then be 
documented. Also, include recognizing risk, detail, focusing 
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on risk, and look at the process are used to determine the 
potential risks to the project(as an input). With these tools, the 
risks are identified and clearly defined and elected. After 
providing the required inputs, using techniques (interviews, 
or check lists) can be used to identify project risks. The 
outputs from risks identification basically are presented are 
kept in a document that it is called the risk document. Outputs 
identified in the first phase includes a list of identified risks is 
associated with their occurrence due. Also, These risks are 
categorized in three different levels (see Table I) according to 
the known and unknown solutions, and causes of these risks. 
Solutions and causes of these risks are categorized after they 
are identified and concentrated on those. 


TABLE I. Risk identification levels[4] 


1 

2 

Solution 

3 

4 

known 

unknown 

Reason 
for risks 

known 

‘valueless 

low 

Risks need high 
technology(serious), large 

unknow 

n 

Risks need 

more 

accuracy 
(disaster), c 
ritical 

Simple risk, tolerable(risks 
that don’t need to be 
solved),middium 


Risks that reasons of those are known, and solution are 
known, these groups of risks are simple, and tolerable, and 
valueless,(worthless). Because they lose less expense, and 
also less time (Table II). This means the risk effective 
decrease [1], and can pass the dangers [8], or dangers can be 
transferred transfer/share [8], By using warrenty and yurantee 
can transfer the risks, also using preventional can decrease the 
risks. 


TABLE II. Solution matrix(reasqn known-solution knqwn)[4] 


i 

2 

solution 

3 

4 

known 

unknown 

Reason 

for 

risks 


‘tolerables ‘Worthless 
simple 

risks 


Outside risk 

Suitable 

for 

transfer 

situation 

request 

Solution 

risk 

unknown 

request 

Solution 

risk 


Risks that reasons are unknown, and solutions are known. 
These group of risks need accuracy, and are disaster, because 
they lose expenses and need more time (Table III). In general 
total of disaster risks have to be taken as a consideration. 


TABLE HI. Solution matrix(solution-cause)(cause 
unknown-solution knqwn[4] 


i 

2 

solution 

3 

4 

known 

unknown 

Cause 

of 

risks 

known 

unknown 

Need more 
accuracy(disaster) 

risks 


organization risks 

Suitable 

for 

Accept 

situation 

request 

Solution 

risk 


Risks that causes are known, and solutions are unknown. 


this group of risks need higher technologies. Because lose a 
lot of expenses and times [Table IV]. This type of rise need 
more time, and less expenses, or less time, and more 
expenses. Also serious risks, have to be considered more than 
medium risks. 


TABLE IV. (SOLUTION-CAUSES) MATRIX(CAUSES KNOWN-SOLUTION 
UNKNOWN) [4] 


i 

2 

solution 

3 

4 

known 

unknown 

Cause 
s of 
risks 

known 


Need high 
technology(serious) 

risks 

Technical risks 

Suitable 

for 

(low)-(decrease) 

situatio 

n 

requested 

Solution 

risk 

Unknow 

n 




Phase 2: Phase analysis of potential risks 

Risk analysis is a major part of risk management. 
Qualitative risk analysis includes methods for prioritizing the 
identified risks. This phase could lead directly to risk 
response planning. Risk effects might be disaster, serious, 
tolerable or worthless. When risks are analyzed, it must be 
decided what the risks are considered in the project. This 
judgment depends on the combination of likelihood and 
impact of risks. The most important and the likehood and 
impact of risks. The most important and the key input 
qualitative risks analysis phase is, the previous phase of the 
output, same as the identified risks. 

Techniques and tools used in the second phase is to assess 
the likelihood and impact of risks. Probability of each specific 
risk will be reviewed. Grading and classification risk analysis 
process, each risk identified, and is considered likely to occur 
and can be seriously discussed. There is no easy way to do 
this, and depending on the experience and judgment of 
management. The following techniques are considered. In the 
quantitative analysis phase, risks are classified as known and 
unknown. Their causes and solutions, as known or unknown. 
Each of them will receive the following values low, medium, 
big crisis, are shown in Table I. 

For simple, and tolerable risks (risks that are not worth 
solving) the average value, and the risk of serious (solving 
them requires high technology great value, and for disaster 
risk controversial (risks that require high a accuracy) is 
considered a critical value, the output of this phase is a 
prioritized list of risks. 

Phase 3: Programmed phase to respond to potential 
risks( risk response) 

In this phase, according to the results of the previous phase, 
we can answer in relating to planning and responding to the 
risks. Risks response planning is the process in which the 
necessary activities are being aimed to reduce the threats. In 
this phase, the most important, and key input, is the output of 
the previous phase. That is. The list of prioritized risks, 
because the process of responding to the risks, considered to 
the priorities of risks. There are several strategies to respond 
to risks. A strategy or combination of strategies that seen to be 
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selected for each risk. If the selected strategy was not quite 
effective, or accepted risk occurs, we can use run a retreat. 
Often a contingency reserve for time or money will be 
considered. Usually, Threats or risks associated with negative 
impacts on project objectives, the following four strategies 
will be considered: 

4) Avoiding: Change management program to remove the 
threats. 

5) Transmission: Shifts negatively associated with 
ownership of the response to the threat of the third party. 

6) Reduction: Primary measures to reduce the probability or 
impact occurred around the threshold of acceptable risk. 

7) Reception: Where it is rarely possible to eliminate all the 
risks of the project it will adopt this strategy. 

Now it should be investigated which of the above strategies 
to respond to each of the identified risks, are more effective. 
As a result. The output will be determined by the risk response 
process. 

Risk response planning process, appropriate responses are 
chosen and agreed upon, and are included in the risk register. 

It is important that the risks are high and the attention to 
detail moderate, and low risk are on a separate list for the 
periodic review. 

Phase 4: Phase control and monitor risks 
Risk monitoring includes regular assessment of risk has 
been identified to be decided whether the probability of that 
risk is reduced or not [1]. Is the effect of risk can be changed 
or not. Risk monitoring is an ongoing process, and the review 
by management. The key risks should be considered 
separately and will be discussed by the supervisor [1]. If any 
changes occur, new risks can be identified through the 
ongoing monitoring and evaluation mechanisms, like other 
planned project risk management process is an interactive 
process that continues throughout the project. When initial 
plans were drawn, the situation will be monitored. By 
providing more information about the risks, remodified with 
new information [1]. This process is simulated using C# codes 
(Appendix 1). 



Figure I. Identification processing risk model of software projects 


III. Case Study 

First Step: Identify Potential Risks 

As it was noted risk identification is the first step in the risk 
management of software projects. Project risk identification 
process to reinforcement users, information and 
communication technology (ICT) in education of mazandaran 
is shown in Figure :I identify risk factors, defines the whole 
process from input to output this process includes input, 
output, processing mechanism, which is shown in Figure II. 



Figure 2. Frame of risk identification. 


A. Input 

This section is made up of parts begin, define, and receive a 
risk. At the beginning string variable is used to define each 
risk. Then an array of type string are defined to hold the list of 
potential risks. In this paper, 13 risks are determined 
according to the results of a research project [4], Also in the 
definition, the list of potential risks and prioritize risk is 
defined, and using production rules (if. . .then. . .) are stored in 
the data base. At the reception section, the risks entered into 
the system by the function Readline() are received. In this 
section the division between the data base and the system is 
established based on the production rules (Appendix 1). 

Type of risks are associated with the effect (the mean 
percentage), and probability of risks (qualitative) are shown 
in Table V. 

B. Output 

A simple method was used for the identification of risk 
commands. The instructions for operating functions 
(search.planning), were implemented by simple structures. 
Instructions for identifying risks in the search result is 
prioritized list of potential risks. Search is a function that at 
each stage, searches for a risk among the potential risk. If it is 
find, another search function, the risk identified in the list of 
prioritized risks searches. 

If you find it, the active risk response plan is based on four 
strategies (avoid, transfer, reduce, accept) the appropriate 
response to each risk. The output of the search algorithm, 
based on production rules (if. . .then. . .) . It will be solution, or 
failure(Appendix 1). 

C. Process Control 

These statements relate to operating functions (control, 
event management, completion), which were implemented by 
simple structures. Also by keeping intermidate results, avoid 
risks and contingency plans are modified with new 
information. Thus, These risks are monitored and controlled. 
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The zero-one deciosion variables to store intermediate results 
of operations itself with reasoning (inference), an intelligent 
even and non-event to manage risk. If (term or condition) then 
(Conclusions or actions). Appendix 1. 

D. Processing mechanisms 

Types of risks in the data base relating to risks and risks are 
prioritized. The risk of a variety of administrative, technical, 
and so on. This means that the risk to the environment by the 
system function (search function, potential risks) using the 
condition, is to identify and prioritize actions. Risk logged in 
the list of potential risks that have already been defined in the 
list, whether it is or not in the list. If it was in the list it goes to 
the next step, and checks the prioritize list, if it was in the list 
of prioritized, then planning of the risk response it is activated 
and the run of the selected of strategy. In the case, the suitable 
of risk response is presented (A good solution is selected 
according to Table IV). Since the observations after each act 
of perception may provide new information about current 
state, Since the observations after each operation may provide 
new information about the current state and the leaves, each 
observation defines a probability that can be programmed for 
it. In this case, the solution can be implemented as a tree, and 
it is often search and run for an alternate (interleave). In this 
case. Algorithm by storing intermediate results (If Control 
and monitoring risk done And the risk is among of the risk 
prioritization), Avoidance strategy of risk And potential Will 
be correct with new information. Otherwise, Do not planning 
of response to the risks and program completion is invoked 
(see Appendix 1). Thus, These risks are monitored and 
controlled. Finally, decision variables to zero and one keeping 
a inference intermediate results in it action, event and 
non-event intelligently managing risk. Selected risk response 


strategies given in the Table III are done. A few steps load to 
the selection and implementation of solutions in risk 
categories are done based on the serverity of the 
consequences and probabilities. As a result, high priority 
risks, low and medium identified and appropriate strategies 
should be chosen according to the Table V, and VIII. 

This step begins with the first phase of the project risk 
management process, risk that may threaten the project should 
be identified. Various categories of project risk can be 
defined depending on the project that will be changed. It is 
required for each risk and it is estimated influence on the 
probability of occurrence of each of the objectives of project. 
But the actual project, a detailed estimated of the probability 
of a risk and its influence on each of the goals of the project is 
not possible. Only a small number of well known risks, the 
probability and impact of the risks on project objectives can 
be identified. The other risks due to the lack of historical data 
is the probability measure of risks can not be a criterion (to 
measure the uncertainty of expert estimates of risk 
occurrence). Indeed, rather than the probability of each risk, 
we will face the degree of Possibility of risk occurrence. Also 
influence of the risk of ambiguity objectives of the project are 
covered. In this project 13 risks are identified from article 
(factors affecting users of ICT in strengthening education of 
mazandaran provience) of research project of education in the 
mazandaran provience with the same name it is shown in 
Table V [5]. The amount of effect, and extent is occurred in 
each category is shown in table. In total 13 different projects 
and there risks are included, and their risks are shown as of 
k={l,2,...,13} according to the Table VI. 


TABLE V. Risks identified on project in enhancing user of ICT in education of mazandaran[3]. 


solutions 

Probability 

of 

occurrence 

Effect or 
serverty of the 
consequences 

causes 

(reasons) 

Risk 

identified 

Kind of risk 

Number 
of risks 

unknown 

low 

4.64 % 
worthless 

Not interested in using ICT 
continued 

interest 

management 

i 

Introduction of using ICT 

high 

11.29% 

disaster 

Not having enough 
knowledge of user, using ICT 

Get 

familiar 

management 

2 

Empowerment by practice 

high 

10.41 % 
disaster 

Not having enough skills 
using ICT 

skill 

management 

3 

unknown 

high 

9.10% 

serious 

Not having enough creation 
using ICT 

creation 

management 

4 

unknown 

high 

10.90 % 
disaster 

Not having enough 
innovation using ICT 

innovatio 

n 

management 

5 

Enowgh software in education 
center 

middium 

8.02 % 
serious 

Not having suitable software 
in education center 

software 

technical 

6 

Enough hardware equipments 
in education center 

low 

5.76 % 
worthless 

Not having enough hardware 
equipments in education 
center 

computer 

technical 

7 

Network setup and installation 
in education center 

low 

5.70 % 
worthless 

Not access to network in 
education center 

network 

technical 

8 

Connect to the internet an lower 
the connection expense 

low 

5.40% 

worthless 

Not access to the internet 

The 

internet 

technical 

9 

Buying magazines and books 
necessary for education center 

low 

6.63 % 
worthless 

Not having enough books 
and mazandaran in education 

center 

Magazine 
and books 

technical 

10 

Guide book for software & 
hardware trouble shoot through 
telephone, web, site, email. 

middium 

8.42 % 
serious 

Not enough support with ICT 

support 

technical 

11 

Goals are known, up to date text 
books, software, hardware, 
accuracy of materials, software, 
hardware for education, using 
new method, for education and 

low 

7.91 % 
serious 

Not enough training for ICT 

education 

technical 

12 
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new perspectives 







Support of management of 
using ICT 

low 

5.77 % 
worthless 

Not enough mazandaran 
support of using ICT 

protection 

technical 

13 


TABLE VI. The main risks identified in enhancing projects of users of ICT of education in mazandaran[3] 


Not having enough access to network in education center 
& work 

K8 

Not having enough desire to reuse and continues user with 
ICT 

K1 

Not having enough access to the internet in education 
center & work 

K9 

Not having enough knowledge, user with ICT 

K2 

Not being equipped with magazine, and book in education 
center & work 

K10 

Not having enough skills, user with ICT 

K3 

Not having enough support work with ICT 

Kll 

Not having enough creation, user with ICT 

K4 

Not having enough training with ICT 

K12 

Not having enough innovation with ICT 

K5 

Not having enough support from management 

Using ICT 

K13 

Not having enough software needed in education center, and 
work 

K6 

Not having enough system of equipment of the internet in education center and work 

K7 


TA BLE vn. Risk classification based on the matrix of consequences and PROBABILITY OF DESCRIPTIVE(QUALITAT rVE) 


Probability of 
occurrence 

consequences 

low 

medium 

high 

i 

2 

3 

low 

Worthless risk-low risk 

Low-low risk 

Serious-nedioum risk 

medium 

Low, low risk 

Serious, medium risk 

Low-low risk 

high 

Serious,medium risk 

Low, low risk 

Disaster risk, high 


TABLE VIII. TYPE OF RISKS. AND DESIGNED STRATEGIES 


strategies 

Variable 2 

strategy 

Variable 1 

Acceptance of existence method 

introduce 

Acceptance of existence method 

interest 

Introduce operator(user) using ICT 

Internet creation for ICT operation(users) 

Absoiption of educated users 

Absorption of interested staff 

strati gies 

Variable 4 

strategy 

Variable 3 

Acceptance of available method 

skill 

Acceptance of existence method 

creativity 

Create skill on users 

Creation of creativity using ICT 

Absorb skilled users using ICT 

Absorption of creative operators(users) 

strategies 

Variable 6 

strategy 

Variable 5 

Acceptance of available method 

software 

Acceptance of existence method 

innovation 

Provision of adequate software 

Creation of innovation using ICT 

Efficient use of software 

Absorption of innovator operator(user) 

strategy 

Variable 8 

strategy 

Variable 7 

Acceptance of available method 

internet 

Acceptance of existence method 

computer 

Providing access to internet users 

Supply enoughcomputer 

Increase speed access to internet 

The use of existing computers 

strategy 

Variable 10 

strategy 

Variable 9 

Acceptance of available method 

The internet 

Acceptance of existence method 

network 

Avoiding magazines and books 

Providing access to internet users 

Providing softwares necessary digital library 

Improve network performance 

strategy 

Variable 12 

strategy 

Variable 1 1 

Acceptance of available method 

education 

Acceptance of existence method 

Method 
support or 
guidance 

Appropriate training 

Help with software, hardware support or 
guidance 

Using new training & various methods for users( virtual) 

Support software, hardware through the 
telephone, web site, email, inspection and 
technical assistance 


strategy 

Variable 13 

Acceptance of existence method 

protection 

Acceptance of available methode 

Protection of management using ICT 


TABLE IX. SELECT APPROPRIATE STRATEGIES FOR ACCEPTABLE AND UNACCEPTABLE RISKS 


Appropriate strategy 

Effect(severity of 
consequences)kind of 
risk 

Kind of risk 

row 


Acceptance of available method 

4.64 % 

Interest 

i 

(A) 

Acceptable risks with law 
impact percent 

Acceptance of available method 

5.40 % 

internet 

2 

Acceptance of available method 

5.70 % 

network 

3 

Acceptance of available method 

5.76 % 

computer 

4 

Acceptance of available method 

5.77 % 

support 

5 

Acceptance of available method 

6.63 % 

Magazines & 
books 

6 

Software & hardware, the internet, guide 

8.41 % 

Help or 

7 

(B) 
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,books 


support 


Tolerable risks with 
medium impact percent 

Appropriate and ontime training 

7.91 % 

training 

8 

Supply enough software 

8.02 % 

software 

9 

Absorbtion of creative users 

9.10 % 

creative 

10 

(Cl 

Unacceptable risks with 
effective percent 

Absorbtion of skilled users using ICT 

10.41 % 

skill 

11 

Hire innovator users 

10.90 % 

innovation 

12 

Hire users with sufficient information literacy 

11.24% 

Familiarity 

knowledge 

13 


Step Three: Select the response risk strategies after 
identifying the key risks for the project must be designed to 
appropriate risks response strategies to deal with them. The 
first phase of the project design appropriate strategies for risk 
management, plan risk response phase of the project. For each 
risk can be a strategy or combination of strategies designed 
and selected for example, if you select one of the two risks 
have generally contradict each other, we are not allowed to 
have another choice. How to select and combine the strategies 
that can be selected for each risk as an important strategic 
constraints in order to be considered a project risk. 

The amount due the unknown impact strategies, are often 
ambiguous, unless the strategy is on target to eliminiate 
completely the risk (probability or impact on the target 
become zero) [5]. For each k-risk, one or more strategies are 

designed, using indices , L={ 1,2,3, Lk}, we have shown 

in Table [8]. It is clear that strategies to deal with risk Boolean 
decision variables are zero-one problems in C# CODE. 

The first strategy is to accept the status situation that is 
related to the risks with high probabilities, or unacceptable 
risks. The second strategy is related to the risks with medium 
probabilities, or tolerable risks. The third strategy is related to 
low probability risks, or acceptable risks. 

IV. Conclusion 

In this paper, a model was developed for identifying 
software project risks. In this model, four strategies is 
anticipated (is discaused) (have been studied) for dealing with 
risks. Notable cases of this model is , programs to avoid risks, 
and that may be amended with new information. Model for 
risk identification process, the initial group project, group 
planning, group process, group process monitoring and 
control, process termination is made . The initial group is 
defined includes starting the process, and the risk. Phases of 
the planning process of risk identification is made, qualitative, 
quantitative risk analysis, and risk response planning. 

First processing group is included starting section, 
definition, and receiving risks. Program processing group has 
formed of identification phase risks, qualitative analysis, and 
risk response planning. Process group(group process), to 
implement new solution uses PDCA (plan-do-check-action) 
risk planning,(implementation, control and monitoring, and 
corrective action). Process end group, uses function factors 
(control, occurrence, therapy) with simple structures were 
implemented and control, and monitoring the risks. 

To identify risk it is used from example application 
(potential project of ICT users in education of mazandaran). 
In this example were used real data. Data base for potential 
risks and prioritization occurs. Algorithms, risk logged in the 
data base search function, and algorithms if there is existence, 
gives the appropriate response to it. This response is based on 


four strategies. It is clear that strategies to deal with the 
problem of risk decision variables are zero and one, which is 
designed in C# code [Appendix 1] so the Boolean variable 
values of ok, and okl are used, to identify, and prioritization 
of risks. Zero decision variables and a response plan do 
control, and monitoring, and response planning for risks. On 
other section decision variables zero and one (0k2) managers 
the occurrence and or non-occurrence of risks. For worthless 
and low strategy risks are selected with least probability. For 
medium risks (seriously strategy with most tolerant (transfer 
strategy), and for the most disaster risks as appropriate 
response strategies most likely to be selected as shown in 
Table VII and VIII. The first strategy is the same as accepting 
the status situation. Means risks with high probability, and 
unacceptable risks, second strategy relate to risks with 
medium probabilities or tolerable probabilities. Third strategy 
related to risks with low probabilities, or acceptable. The 
advantages of this method is a simple algorithm to evolve a 
simple mechanism on and off for each risk, and the strategies 
for tolerable risks acceptable and unacceptable risks. 

Note that the values of the intensity of effect of risks have 
been carried out from project, as a result using qualitative 
variables to classify and prioritize risks may be a good way. 
Also using the values of Boolean ok, okl, ok2 in c# code. 
Boolean variable design help identify a strategy for each of 
the risks. 

The resulting optimization solution and select of an 
appropriate solution to deal with the risks. The distinguishes 
of the results of this paper with the paper [5] is, in this paper 
the research have access to numeric values (percent boost 
users factors influencing ICT), have been extracted from the 
project. Thus, structural constraints and criteria were 
involved for selection of risk management used to derive 
conclusions. Considering the range of numerical values for 
the mean of the impact of 4.64 to 1 1 .24, and T able VII and IX. 
These values were classified into 3 intervals. Experts with 
linguistic variables in this paper in three categories (low, 
medium, high) were classified. The implementation of this 
model is varies stages leading to optimized selection of the 
new solution transparent and effective management. Output 
reduces the cost, schedule, and quality of software 
development. Risks and complexities, and uncertainties are 
controlled. Finally it is suggested that this model is 
implemented as an expert system using a suitable software. 

Appendix 1: C# Codes 

using system; 
using system.text; 
using system; 
namespace Risk 
{ 

public main[] 
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{ 

String [ ] RiskListPotential=new string [] {List of Risks 
Potential } ; 

String [ ] RiskListPriority=new string [] { List of Risks 
Prioritize } ; 
var Risk=""; 
boolean ok,okl=false; 

Readline(Risk); 

ok=SearchRiskPotential(Risk); 

if(ok==true) 

{ 

okl=SearchRiskPriority(Risk); 

if(okl==true) 

{ 

label 100: 

if(PlanningRisk==true) 

{ 

if(Control&RiskOversight==true && okl==true) 

{ 

if(ok2==true) 

{ 

RiskTreatment(); 
goto 100; 

} 

else 

{ 

Completion!); 

} 

} 

else 

{ 

Completion!); 

} 

} 

} 

} 

boolean SearchRiskPotential (String Risk) 

{ 

if!RiskListPotential.Find(Risk)) 

return true; 

else 

return false; 

} 

boolean SearchRiskPriority (String Risk) 

{ 

if(RiskListPriority.Find (Risk)) 

return true; 

else 

return false; 

} 

boolean PlanningRisk (String Risk) 

{ 

if(Risk.isprogramed) 

return true; 

else 

return false; 

} 

boolean Control&RiskOversight (String Risk) 

{ 

if(Risk.Iscontroled&analyzed) 

return true; 

else 


return false; 

} 

boolean EventRisk (String Risk) 

{ 

if(Risk.Isactive) 
return true; 
else 

return false; 

} 

void RiskTreatment (String Risk) 

{ 

Risk.Treatment(); 

} 

boolean Completion!) 

{ 

int flag=Readline(); 

if(flag==l) 

return; 

else 

close; 

} 

} 

} 
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